uvm_fault: in_pcbhash_insert
0 views
Skip to first unread message
syzbot
Jul 20, 2026, 10:01:34 PM (7 days ago) Jul 20
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: d55fd7dd01df Add add ECDSA tests (based on the RSA tests)
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=101612b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link: https://syzkaller.appspot.com/bug?extid=a52c5bdbd489896eb29b
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8e06f391445c/disk-d55fd7dd.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/223b2a01ea19/bsd-d55fd7dd.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4fac557ddd66/kernel-d55fd7dd.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a52c5b...@syzkaller.appspotmail.com
uvm_fault(0xffffef007577c188, 0xa00000094, 0, 2) -> e
kernel: page fault trap, code=2
Stopped at in_pcbhash_insert+0x155: movq %rbx,0x30(%r13)
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*311027 84973 0 0 0x4000000 0 syz-executor
in_pcbhash_insert(ffffef0070667000) at in_pcbhash_insert+0x155 sys/netinet/in_pcb.c:1096
in_pcballoc(ffff800010fdef28,ffffffff83a63a60,1) at in_pcballoc+0x23a sys/netinet/in_pcb.c:269
rip_attach(ffff800010fdef28,20,1) at rip_attach+0x117 sys/netinet/raw_ip.c:489
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f pru_attach sys/sys/protosw.h:275 [inline]
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f sys/kern/uipc_socket.c:220
sys_socket(ffff80002a79e2b0,ffff8000380d5960,ffff8000380d58b0) at sys_socket+0x124 sys/kern/uipc_syscalls.c:102
syscall(ffff8000380d5960) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000380d5960) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x912f653b690, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffef007577c188, 0xa00000094, 0, 2) -> e
ddb> show kasan
No such command
ddb> trace
in_pcbhash_insert(ffffef0070667000) at in_pcbhash_insert+0x155 sys/netinet/in_pcb.c:1096
in_pcballoc(ffff800010fdef28,ffffffff83a63a60,1) at in_pcballoc+0x23a sys/netinet/in_pcb.c:269
rip_attach(ffff800010fdef28,20,1) at rip_attach+0x117 sys/netinet/raw_ip.c:489
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f pru_attach sys/sys/protosw.h:275 [inline]
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f sys/kern/uipc_socket.c:220
sys_socket(ffff80002a79e2b0,ffff8000380d5960,ffff8000380d58b0) at sys_socket+0x124 sys/kern/uipc_syscalls.c:102
syscall(ffff8000380d5960) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000380d5960) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x912f653b690, count: -7
ddb> show registers
rdi 0xffff8000380d6000
rsi 0x566
rbp 0xffff8000380d56c0
rbx 0xffffef0070667028
rdx 0xffff8000380d6000
rcx 0x565
rax 0xffffffff82b702ac in_pcbhash_insert+0x14c
r8 0x30
r9 0
r10 0x4a5a5b6b4e0361
r11 0xd582d32e4fdbd4cf
r12 0xffff800000c57700
r13 0xa00000064
r14 0xffffef0070667000
r15 0xffffffff83a63a60 rawcbtable
rip 0xffffffff82b702b5 in_pcbhash_insert+0x155
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff8000380d5630
ss 0x10
in_pcbhash_insert+0x155: movq %rbx,0x30(%r13)
ddb> show proc
PROC (syz-executor) tid=311027 pid=84973 tcnt=2 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=50, usrpri=50, slppri=17, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a79e018,0xffffffff83a47540
process=0xffff800045ff9698 user=0xffff8000380d0000, vmspace=0xffffef007577c188
estcpu=0, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
84973 268763 62777 0 2 0 0 syz-executor
*84973 311027 62777 0 7 0 0x4000000 syz-executor
74717 100454 81853 0 3 0 0x80 nanoslp syz-executor
74717 26915 81853 0 3 0 0x4000080 fsleep syz-executor
62547 13142 62012 0 2 0 0 syz-executor
88614 347773 34766 0 2 0 0 syz-executor
88614 109824 34766 0 3 0 0x4000080 fsleep syz-executor
10631 42680 36367 0 2 0 0 syz-executor
10631 395265 36367 0 3 0 0x4000080 fsleep syz-executor
28449 166139 69054 0 2 0 0 syz-executor
28449 372770 69054 0 3 0 0x4000080 fsleep syz-executor
13312 464740 2183 0 2 0x2 0 arp
2183 388618 40658 0 3 0x100002 0x88 sigsusp sh
62012 470041 10378 0 3 0x2 0x80 nanoslp syz-executor
62777 119530 10378 0 3 0x2 0x80 nanoslp syz-executor
36367 332824 10378 0 3 0x2 0x80 nanoslp syz-executor
34766 144551 10378 0 3 0x2 0x80 nanoslp syz-executor
87713 71956 10378 0 2 0x2 0 syz-executor
69054 390662 10378 0 3 0x2 0x80 nanoslp syz-executor
81853 339350 10378 0 3 0x2 0x80 nanoslp syz-executor
40658 460033 10378 0 3 0x2 0x80 wait syz-executor
10378 371625 7516 0 3 0x2 0x80 kqread syz-executor
7516 361043 85215 0 3 0x100002 0x88 sigsusp ksh
85215 77656 84166 0 3 0x10 0x88 kqread sshd-session
84166 109290 9306 0 3 0x12 0x80 kqread sshd-session
69471 146246 1 0 3 0x100003 0x80 ttyin getty
9306 47761 1 0 3 0 0x88 kqread sshd
54202 312216 64984 73 3 0x1100010 0x80 kqread syslogd
64984 170309 1 0 3 0x100002 0x80 sbwait syslogd
84197 286720 1 0 3 0x100000 0x80 kqread resolvd
14598 385134 75573 77 3 0x100012 0x80 kqread dhcpleased
62674 471037 75573 77 3 0x100012 0x80 kqread dhcpleased
75573 305475 1 0 3 0 0x80 kqread dhcpleased
48399 441553 0 0 3 0x14000 0x200 bored smr
12371 66961 0 0 2 0x14000 0x200 zerothread
56733 315936 0 0 3 0x14000 0x200 aiodoned aiodoned
96292 32691 0 0 3 0x14000 0x200 syncer update
56309 408066 0 0 3 0x14000 0x200 cleaner cleaner
56652 282349 0 0 3 0x14000 0x200 reaper reaper
54958 466867 0 0 3 0x14000 0x200 pgdaemon pagedaemon
31695 224900 0 0 3 0x14000 0x200 bored viomb
67525 121934 0 0 3 0x14000 0x40000200 acpi0 acpi0
24348 309942 0 0 2 0x14000 0x200 softnet0
82620 87223 0 0 3 0x14000 0x200 smrbar systqmp
44023 202798 0 0 3 0x14000 0x200 bored systq
90950 17721 0 0 3 0x14000 0x40000200 tmoslp softclock
88730 297176 0 0 3 0x14000 0x40000200 idle0
1 261391 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11025 12098K 12167K 166960K 12119 0
pcb 17 12K 12K 166960K 20 0
rtable 221 6K 6K 166960K 329 0
pf 30 12K 14K 166960K 35 0
ifaddr 40 7K 7K 166960K 42 0
ifgroup 50 2K 2K 166960K 50 0
sysctl 1 1K 9K 166960K 5 0
counters 33 17K 17K 166960K 33 0
ioctlops 0 0K 4K 166960K 32 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1289 81K 81K 166960K 1362 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 1K 166960K 2 0
VM map 2 1K 1K 166960K 2 0
sem 2 0K 0K 166960K 2 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 291K 166960K 11964 0
file desc 18 65K 89K 166960K 149 0
proc 57 58K 91K 166960K 488 0
subproc 72 4K 4K 166960K 72 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 4 0
in_multi 89 6K 6K 166960K 90 0
ether_multi 1 0K 0K 166960K 1 0
mrt 1 0K 0K 166960K 2 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 31 148K 148K 166960K 31 0
exec 0 0K 1K 166960K 362 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 208 151K 158K 166960K 3011 0
UVM aobj 3 2K 2K 166960K 3 0
pinsyscall 40 80K 92K 166960K 1240 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
NDP 25 1K 1K 166960K 25 0
temp 35 9106K 9112K 166960K 3562 0
kqueue 13 20K 22K 166960K 26 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 34 0 31 1 0 1 1 0 8 0
rtentry 136 103 0 1 4 0 4 4 0 8 0
unpcb 144 45 0 29 1 0 1 1 0 8 0
syncache 336 5 0 5 1 0 1 1 0 8 1
tcpcb 736 9 0 5 1 0 1 1 0 8 0
arp 96 17 0 0 1 0 1 1 0 8 0
inpcb 328 69 0 60 2 0 2 2 0 8 1
nd6 112 21 0 0 1 0 1 1 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
pfrule 1360 2 0 2 1 0 1 1 0 8 1
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 412 0 0 26 0 26 26 0 8 0
art_table 40 413 0 0 5 0 5 5 0 8 0
art_node 32 103 0 9 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1579 0 122 92 0 92 92 0 8 0
ffsino 256 1579 0 122 92 0 92 92 0 8 0
nchpl 144 1796 0 108 63 0 63 63 0 8 0
vnodes 216 1665 0 0 93 0 93 93 0 8 0
namei 1024 5219 0 5218 2 0 2 2 0 8 1
kstatmem 264 23 0 0 2 0 2 2 0 8 0
scxspl 216 6025 0 6025 4 0 4 4 1 8 4
plimitpl 152 30 0 14 1 0 1 1 0 8 0
sigapl 424 444 0 401 6 0 6 6 0 8 0
knotepl 120 2711 0 2664 9 0 9 9 0 8 7
kqueuepl 184 22 0 13 1 0 1 1 0 8 0
pipepl 304 122 0 95 3 0 3 3 0 8 0
fdescpl 448 431 0 401 5 0 5 5 0 8 1
filepl 120 1473 0 1268 7 0 7 7 0 8 0
lockfpl 104 10 0 8 1 0 1 1 0 8 0
lockfspl 48 6 0 4 1 0 1 1 0 8 0
sessionpl 144 23 0 15 1 0 1 1 0 8 0
pgrppl 48 32 0 16 1 0 1 1 0 8 0
ucredpl 104 80 0 69 1 0 1 1 0 8 0
zombiepl 144 401 0 401 1 0 1 1 0 8 1
processpl 1152 444 0 401 4 0 4 4 0 8 0
procpl 664 468 0 420 5 0 5 5 0 8 0
sockpl 552 148 0 120 3 0 3 3 0 8 0
mcl64k 65536 1 0 1 1 0 1 1 0 8 1
mcl12k 12288 1 0 1 1 0 1 1 0 8 1
mcl8k 8192 5 0 5 1 0 1 1 0 8 1
mcl4k 4096 2487 0 2434 14 0 14 14 0 8 6
mcl2k 2048 117 0 116 1 0 1 1 0 8 0
mextrefs 64 47 0 46 1 0 1 1 0 8 0
mtagpl 96 4 0 4 1 0 1 1 0 8 1
mbufpl 256 4225 0 4102 9 0 9 9 0 8 1
bufpl 272 2242 0 102 143 0 143 143 0 8 0
anonpl 24 77523 0 74571 20 0 20 20 0 187 1
amapchunkpl 152 7969 0 7545 18 0 18 18 0 158 0
amappl16 200 1085 0 1071 4 0 4 4 0 8 3
amappl15 192 26 0 26 1 0 1 1 0 8 1
amappl14 184 409 0 406 1 0 1 1 0 8 0
amappl13 176 115 0 104 1 0 1 1 0 8 0
amappl12 168 663 0 635 2 0 2 2 0 8 0
amappl11 160 5 0 5 1 0 1 1 0 8 1
amappl10 152 60 0 50 1 0 1 1 0 8 0
amappl9 144 272 0 272 1 0 1 1 0 8 1
amappl8 136 91 0 90 1 0 1 1 0 8 0
amappl7 128 140 0 127 1 0 1 1 0 8 0
amappl6 120 143 0 141 1 0 1 1 0 8 0
amappl5 112 90 0 83 1 0 1 1 0 8 0
amappl4 104 262 0 246 1 0 1 1 0 8 0
amappl3 96 1455 0 1356 3 0 3 3 0 8 0
amappl2 88 516 0 463 2 0 2 2 0 8 0
amappl1 80 10082 0 9517 13 0 13 13 0 8 0
amappl 88 2322 0 2179 4 0 4 4 0 92 0
uvmvnodes 80 97 0 0 2 0 2 2 0 8 0
dma4096 4096 1 0 1 1 0 1 1 0 8 1
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 7 0 7 1 0 1 1 0 8 1
dma128 128 253 0 253 1 0 1 1 0 8 1
dma64 64 6 0 6 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 2 0 0 1 0 1 1 0 8 0
uaddrrnd 24 431 0 401 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 431 0 401 1 0 1 1 0 8 0
vmmpekpl 168 5400 0 5375 2 0 2 2 0 8 0
vmmpepl 168 36293 0 34559 79 0 79 79 0 357 1
vmsppl 368 430 0 401 4 0 4 4 0 8 0
rwobjpl 40 13369 0 12429 11 0 11 11 0 8 0
pdppl 4096 868 0 802 92 14 78 78 0 8 12
pvpl 32 199198 0 191511 68 0 68 68 0 265 0
pmappl 216 430 0 401 2 0 2 2 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 112 492 0 14 14 0 14 14 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
in_pcbhash_insert(ffffef0070667000) at in_pcbhash_insert+0x155 sys/netinet/in_pcb.c:1096
in_pcballoc(ffff800010fdef28,ffffffff83a63a60,1) at in_pcballoc+0x23a sys/netinet/in_pcb.c:269
rip_attach(ffff800010fdef28,20,1) at rip_attach+0x117 sys/netinet/raw_ip.c:489
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f pru_attach sys/sys/protosw.h:275 [inline]
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f sys/kern/uipc_socket.c:220
sys_socket(ffff80002a79e2b0,ffff8000380d5960,ffff8000380d58b0) at sys_socket+0x124 sys/kern/uipc_syscalls.c:102
syscall(ffff8000380d5960) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000380d5960) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x912f653b690, count: -7
ddb> machine ddbcpu 1
No such command
ddb> trace
in_pcbhash_insert(ffffef0070667000) at in_pcbhash_insert+0x155 sys/netinet/in_pcb.c:1096
in_pcballoc(ffff800010fdef28,ffffffff83a63a60,1) at in_pcballoc+0x23a sys/netinet/in_pcb.c:269
rip_attach(ffff800010fdef28,20,1) at rip_attach+0x117 sys/netinet/raw_ip.c:489
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f pru_attach sys/sys/protosw.h:275 [inline]
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f sys/kern/uipc_socket.c:220
sys_socket(ffff80002a79e2b0,ffff8000380d5960,ffff8000380d58b0) at sys_socket+0x124 sys/kern/uipc_syscalls.c:102
syscall(ffff8000380d5960) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000380d5960) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x912f653b690, count: -7
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: d55fd7dd01df Add add ECDSA tests (based on the RSA tests)
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=101612b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link: https://syzkaller.appspot.com/bug?extid=a52c5bdbd489896eb29b
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8e06f391445c/disk-d55fd7dd.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/223b2a01ea19/bsd-d55fd7dd.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4fac557ddd66/kernel-d55fd7dd.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a52c5b...@syzkaller.appspotmail.com
uvm_fault(0xffffef007577c188, 0xa00000094, 0, 2) -> e
kernel: page fault trap, code=2
Stopped at in_pcbhash_insert+0x155: movq %rbx,0x30(%r13)
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*311027 84973 0 0 0x4000000 0 syz-executor
in_pcbhash_insert(ffffef0070667000) at in_pcbhash_insert+0x155 sys/netinet/in_pcb.c:1096
in_pcballoc(ffff800010fdef28,ffffffff83a63a60,1) at in_pcballoc+0x23a sys/netinet/in_pcb.c:269
rip_attach(ffff800010fdef28,20,1) at rip_attach+0x117 sys/netinet/raw_ip.c:489
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f pru_attach sys/sys/protosw.h:275 [inline]
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f sys/kern/uipc_socket.c:220
sys_socket(ffff80002a79e2b0,ffff8000380d5960,ffff8000380d58b0) at sys_socket+0x124 sys/kern/uipc_syscalls.c:102
syscall(ffff8000380d5960) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000380d5960) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x912f653b690, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffef007577c188, 0xa00000094, 0, 2) -> e
ddb> show kasan
No such command
ddb> trace
in_pcbhash_insert(ffffef0070667000) at in_pcbhash_insert+0x155 sys/netinet/in_pcb.c:1096
in_pcballoc(ffff800010fdef28,ffffffff83a63a60,1) at in_pcballoc+0x23a sys/netinet/in_pcb.c:269
rip_attach(ffff800010fdef28,20,1) at rip_attach+0x117 sys/netinet/raw_ip.c:489
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f pru_attach sys/sys/protosw.h:275 [inline]
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f sys/kern/uipc_socket.c:220
sys_socket(ffff80002a79e2b0,ffff8000380d5960,ffff8000380d58b0) at sys_socket+0x124 sys/kern/uipc_syscalls.c:102
syscall(ffff8000380d5960) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000380d5960) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x912f653b690, count: -7
ddb> show registers
rdi 0xffff8000380d6000
rsi 0x566
rbp 0xffff8000380d56c0
rbx 0xffffef0070667028
rdx 0xffff8000380d6000
rcx 0x565
rax 0xffffffff82b702ac in_pcbhash_insert+0x14c
r8 0x30
r9 0
r10 0x4a5a5b6b4e0361
r11 0xd582d32e4fdbd4cf
r12 0xffff800000c57700
r13 0xa00000064
r14 0xffffef0070667000
r15 0xffffffff83a63a60 rawcbtable
rip 0xffffffff82b702b5 in_pcbhash_insert+0x155
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff8000380d5630
ss 0x10
in_pcbhash_insert+0x155: movq %rbx,0x30(%r13)
ddb> show proc
PROC (syz-executor) tid=311027 pid=84973 tcnt=2 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=50, usrpri=50, slppri=17, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a79e018,0xffffffff83a47540
process=0xffff800045ff9698 user=0xffff8000380d0000, vmspace=0xffffef007577c188
estcpu=0, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
84973 268763 62777 0 2 0 0 syz-executor
*84973 311027 62777 0 7 0 0x4000000 syz-executor
74717 100454 81853 0 3 0 0x80 nanoslp syz-executor
74717 26915 81853 0 3 0 0x4000080 fsleep syz-executor
62547 13142 62012 0 2 0 0 syz-executor
88614 347773 34766 0 2 0 0 syz-executor
88614 109824 34766 0 3 0 0x4000080 fsleep syz-executor
10631 42680 36367 0 2 0 0 syz-executor
10631 395265 36367 0 3 0 0x4000080 fsleep syz-executor
28449 166139 69054 0 2 0 0 syz-executor
28449 372770 69054 0 3 0 0x4000080 fsleep syz-executor
13312 464740 2183 0 2 0x2 0 arp
2183 388618 40658 0 3 0x100002 0x88 sigsusp sh
62012 470041 10378 0 3 0x2 0x80 nanoslp syz-executor
62777 119530 10378 0 3 0x2 0x80 nanoslp syz-executor
36367 332824 10378 0 3 0x2 0x80 nanoslp syz-executor
34766 144551 10378 0 3 0x2 0x80 nanoslp syz-executor
87713 71956 10378 0 2 0x2 0 syz-executor
69054 390662 10378 0 3 0x2 0x80 nanoslp syz-executor
81853 339350 10378 0 3 0x2 0x80 nanoslp syz-executor
40658 460033 10378 0 3 0x2 0x80 wait syz-executor
10378 371625 7516 0 3 0x2 0x80 kqread syz-executor
7516 361043 85215 0 3 0x100002 0x88 sigsusp ksh
85215 77656 84166 0 3 0x10 0x88 kqread sshd-session
84166 109290 9306 0 3 0x12 0x80 kqread sshd-session
69471 146246 1 0 3 0x100003 0x80 ttyin getty
9306 47761 1 0 3 0 0x88 kqread sshd
54202 312216 64984 73 3 0x1100010 0x80 kqread syslogd
64984 170309 1 0 3 0x100002 0x80 sbwait syslogd
84197 286720 1 0 3 0x100000 0x80 kqread resolvd
14598 385134 75573 77 3 0x100012 0x80 kqread dhcpleased
62674 471037 75573 77 3 0x100012 0x80 kqread dhcpleased
75573 305475 1 0 3 0 0x80 kqread dhcpleased
48399 441553 0 0 3 0x14000 0x200 bored smr
12371 66961 0 0 2 0x14000 0x200 zerothread
56733 315936 0 0 3 0x14000 0x200 aiodoned aiodoned
96292 32691 0 0 3 0x14000 0x200 syncer update
56309 408066 0 0 3 0x14000 0x200 cleaner cleaner
56652 282349 0 0 3 0x14000 0x200 reaper reaper
54958 466867 0 0 3 0x14000 0x200 pgdaemon pagedaemon
31695 224900 0 0 3 0x14000 0x200 bored viomb
67525 121934 0 0 3 0x14000 0x40000200 acpi0 acpi0
24348 309942 0 0 2 0x14000 0x200 softnet0
82620 87223 0 0 3 0x14000 0x200 smrbar systqmp
44023 202798 0 0 3 0x14000 0x200 bored systq
90950 17721 0 0 3 0x14000 0x40000200 tmoslp softclock
88730 297176 0 0 3 0x14000 0x40000200 idle0
1 261391 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11025 12098K 12167K 166960K 12119 0
pcb 17 12K 12K 166960K 20 0
rtable 221 6K 6K 166960K 329 0
pf 30 12K 14K 166960K 35 0
ifaddr 40 7K 7K 166960K 42 0
ifgroup 50 2K 2K 166960K 50 0
sysctl 1 1K 9K 166960K 5 0
counters 33 17K 17K 166960K 33 0
ioctlops 0 0K 4K 166960K 32 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1289 81K 81K 166960K 1362 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 1K 166960K 2 0
VM map 2 1K 1K 166960K 2 0
sem 2 0K 0K 166960K 2 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1734 201K 291K 166960K 11964 0
file desc 18 65K 89K 166960K 149 0
proc 57 58K 91K 166960K 488 0
subproc 72 4K 4K 166960K 72 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 4 0
in_multi 89 6K 6K 166960K 90 0
ether_multi 1 0K 0K 166960K 1 0
mrt 1 0K 0K 166960K 2 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 31 148K 148K 166960K 31 0
exec 0 0K 1K 166960K 362 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 208 151K 158K 166960K 3011 0
UVM aobj 3 2K 2K 166960K 3 0
pinsyscall 40 80K 92K 166960K 1240 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
NDP 25 1K 1K 166960K 25 0
temp 35 9106K 9112K 166960K 3562 0
kqueue 13 20K 22K 166960K 26 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 34 0 31 1 0 1 1 0 8 0
rtentry 136 103 0 1 4 0 4 4 0 8 0
unpcb 144 45 0 29 1 0 1 1 0 8 0
syncache 336 5 0 5 1 0 1 1 0 8 1
tcpcb 736 9 0 5 1 0 1 1 0 8 0
arp 96 17 0 0 1 0 1 1 0 8 0
inpcb 328 69 0 60 2 0 2 2 0 8 1
nd6 112 21 0 0 1 0 1 1 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
pfrule 1360 2 0 2 1 0 1 1 0 8 1
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 412 0 0 26 0 26 26 0 8 0
art_table 40 413 0 0 5 0 5 5 0 8 0
art_node 32 103 0 9 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1579 0 122 92 0 92 92 0 8 0
ffsino 256 1579 0 122 92 0 92 92 0 8 0
nchpl 144 1796 0 108 63 0 63 63 0 8 0
vnodes 216 1665 0 0 93 0 93 93 0 8 0
namei 1024 5219 0 5218 2 0 2 2 0 8 1
kstatmem 264 23 0 0 2 0 2 2 0 8 0
scxspl 216 6025 0 6025 4 0 4 4 1 8 4
plimitpl 152 30 0 14 1 0 1 1 0 8 0
sigapl 424 444 0 401 6 0 6 6 0 8 0
knotepl 120 2711 0 2664 9 0 9 9 0 8 7
kqueuepl 184 22 0 13 1 0 1 1 0 8 0
pipepl 304 122 0 95 3 0 3 3 0 8 0
fdescpl 448 431 0 401 5 0 5 5 0 8 1
filepl 120 1473 0 1268 7 0 7 7 0 8 0
lockfpl 104 10 0 8 1 0 1 1 0 8 0
lockfspl 48 6 0 4 1 0 1 1 0 8 0
sessionpl 144 23 0 15 1 0 1 1 0 8 0
pgrppl 48 32 0 16 1 0 1 1 0 8 0
ucredpl 104 80 0 69 1 0 1 1 0 8 0
zombiepl 144 401 0 401 1 0 1 1 0 8 1
processpl 1152 444 0 401 4 0 4 4 0 8 0
procpl 664 468 0 420 5 0 5 5 0 8 0
sockpl 552 148 0 120 3 0 3 3 0 8 0
mcl64k 65536 1 0 1 1 0 1 1 0 8 1
mcl12k 12288 1 0 1 1 0 1 1 0 8 1
mcl8k 8192 5 0 5 1 0 1 1 0 8 1
mcl4k 4096 2487 0 2434 14 0 14 14 0 8 6
mcl2k 2048 117 0 116 1 0 1 1 0 8 0
mextrefs 64 47 0 46 1 0 1 1 0 8 0
mtagpl 96 4 0 4 1 0 1 1 0 8 1
mbufpl 256 4225 0 4102 9 0 9 9 0 8 1
bufpl 272 2242 0 102 143 0 143 143 0 8 0
anonpl 24 77523 0 74571 20 0 20 20 0 187 1
amapchunkpl 152 7969 0 7545 18 0 18 18 0 158 0
amappl16 200 1085 0 1071 4 0 4 4 0 8 3
amappl15 192 26 0 26 1 0 1 1 0 8 1
amappl14 184 409 0 406 1 0 1 1 0 8 0
amappl13 176 115 0 104 1 0 1 1 0 8 0
amappl12 168 663 0 635 2 0 2 2 0 8 0
amappl11 160 5 0 5 1 0 1 1 0 8 1
amappl10 152 60 0 50 1 0 1 1 0 8 0
amappl9 144 272 0 272 1 0 1 1 0 8 1
amappl8 136 91 0 90 1 0 1 1 0 8 0
amappl7 128 140 0 127 1 0 1 1 0 8 0
amappl6 120 143 0 141 1 0 1 1 0 8 0
amappl5 112 90 0 83 1 0 1 1 0 8 0
amappl4 104 262 0 246 1 0 1 1 0 8 0
amappl3 96 1455 0 1356 3 0 3 3 0 8 0
amappl2 88 516 0 463 2 0 2 2 0 8 0
amappl1 80 10082 0 9517 13 0 13 13 0 8 0
amappl 88 2322 0 2179 4 0 4 4 0 92 0
uvmvnodes 80 97 0 0 2 0 2 2 0 8 0
dma4096 4096 1 0 1 1 0 1 1 0 8 1
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 7 0 7 1 0 1 1 0 8 1
dma128 128 253 0 253 1 0 1 1 0 8 1
dma64 64 6 0 6 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 2 0 0 1 0 1 1 0 8 0
uaddrrnd 24 431 0 401 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 431 0 401 1 0 1 1 0 8 0
vmmpekpl 168 5400 0 5375 2 0 2 2 0 8 0
vmmpepl 168 36293 0 34559 79 0 79 79 0 357 1
vmsppl 368 430 0 401 4 0 4 4 0 8 0
rwobjpl 40 13369 0 12429 11 0 11 11 0 8 0
pdppl 4096 868 0 802 92 14 78 78 0 8 12
pvpl 32 199198 0 191511 68 0 68 68 0 265 0
pmappl 216 430 0 401 2 0 2 2 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 112 492 0 14 14 0 14 14 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
in_pcbhash_insert(ffffef0070667000) at in_pcbhash_insert+0x155 sys/netinet/in_pcb.c:1096
in_pcballoc(ffff800010fdef28,ffffffff83a63a60,1) at in_pcballoc+0x23a sys/netinet/in_pcb.c:269
rip_attach(ffff800010fdef28,20,1) at rip_attach+0x117 sys/netinet/raw_ip.c:489
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f pru_attach sys/sys/protosw.h:275 [inline]
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f sys/kern/uipc_socket.c:220
sys_socket(ffff80002a79e2b0,ffff8000380d5960,ffff8000380d58b0) at sys_socket+0x124 sys/kern/uipc_syscalls.c:102
syscall(ffff8000380d5960) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000380d5960) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x912f653b690, count: -7
ddb> machine ddbcpu 1
No such command
ddb> trace
in_pcbhash_insert(ffffef0070667000) at in_pcbhash_insert+0x155 sys/netinet/in_pcb.c:1096
in_pcballoc(ffff800010fdef28,ffffffff83a63a60,1) at in_pcballoc+0x23a sys/netinet/in_pcb.c:269
rip_attach(ffff800010fdef28,20,1) at rip_attach+0x117 sys/netinet/raw_ip.c:489
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f pru_attach sys/sys/protosw.h:275 [inline]
socreate(2,ffff8000380d5820,3,20) at socreate+0x22f sys/kern/uipc_socket.c:220
sys_socket(ffff80002a79e2b0,ffff8000380d5960,ffff8000380d58b0) at sys_socket+0x124 sys/kern/uipc_syscalls.c:102
syscall(ffff8000380d5960) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000380d5960) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x912f653b690, count: -7
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages